How to stop zero-click AdFection spyware - Turning off Javascript in Chrome

The first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising, which we call AdFection is out. 


The operations of the cyber-attack company Candiru have been sold to the investment fund American investment fund Integrity Partners for up to $30 million. According to an agreement signed several months ago, the fund purchased Candiru’s assets and transferred them—along with all of the company's employees—to a new entity that is not subject to U.S. government sanctions.

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab

Here's how to stop the spread

To disable JavaScript for all websites in Google Chrome, follow these steps:

1. Open Chrome.

2. Copy and paste this address into the address bar:
   
   chrome://settings/content/javascript

3. Press Enter.

4. Select Don't allow sites to use JavaScript or switch the JavaScript permission toggle off, depending on your Chrome version.
   
   

   
   
   

5. Close Settings and reload any open websites by pressing Ctrl + R.

To verify: Return to chrome://settings/content/javascript and confirm that JavaScript is blocked by default.

Note: This setting applies to all websites unless you add individual site exceptions. Some websites, including banking sites, login pages, and CAPTCHA systems, may not function properly.

6. To re-enable JavaScript per site, click <x> to add site to allow JavaScript (whitelist). 

Example Phishing email from generic Cloud company with Subject Your storage is full. Deletion in progress

For the record, this is a cloud phishing email attempt that is recently going around, with subject "Endurance Auto Protection: Get your free vehicle protection quote today".

What to do?  Report them, go to bottom of page. 

From: Endurance Auto Protection<alert@propriata.com> Subject: Endurance Auto Protection: Get your free vehicle protection quote today

Phishing Link

1. https://propriata.com/xxxx

How to tell this is a Phishing email?

1. Check email address in full, if it's not from originating company then it's phishing.
2. Hover over all links in email, if it's not from the company's website then forget it.
3. The best way is to look at message source, see below.

How to examine Email Message Source?

Now let's look at message source

1. Outlook.com->Actions->View Message Source. 
2. Gmail.com->More (down arrow to top right)->Show original.

Check for suspicious links, anything that does not originate from source domain, like apple.com.

-------------------------------------------------------------------------------------------------------------

Report Phishing Email (not as Spam)

1. Outlook.com->Junk (at Top)->Phishing Scam
2. Gmail.com->More (down-arrow to top right)->Report Phishing 

Report Phishing to Google

If you have received this email, take further action by

1. https://www.google.com/safebrowsing/report_phish/

Report phishing at Microsoft and government agencies

1. http://www.microsoft.com/security/online-privacy/phishing-faq.aspx

Report phishing for Web hosting companies (e.g., GoDaddy, Cloudflare, Digital Ocean) and ISPs

1. SpamCop.net - Sign up for SpamCop reporting

Anti‑Phishing Working Group (APWG) — forward to reportphishing@apwg.org

-------------------------------------------------------------------------------------------------------------

💣 📧 Check if your username or email has been hacked

Example SPAM Email from Pharmacy2U with Subject Get your NHS repeat prescriptions the easy way with Pharmacy2U

For the record, this is a Window Nation spam email attempt that is recently going around, with subject "Get your NHS repeat prescriptions the easy way with Pharmacy2U"

What to do?  Report them, go to bottom of page. 

From: Online Pharmacy<contact@xg66888.com> Subject: Get your NHS repeat prescriptions the easy way with Pharmacy2U

Spam Link

1. https://www.xg66888.com/xxxx

How to tell this is a Phishing email?

1. Check email address in full, if it's not from originating company then it's phishing.
2. Hover over all links in email, if it's not from the company's website then forget it.
3. The best way is to look at message source, see below.

How to examine Email Message Source?

Now let's look at message source

1. Outlook.com->Actions->View Message Source. 
2. Gmail.com->More (down arrow to top right)->Show original.

Check for suspicious links, anything that does not originate from source domain, like apple.com.

-------------------------------------------------------------------------------------------------------------

Report Phishing Email (not as Spam)

1. Outlook.com->Junk (at Top)->Phishing Scam
2. Gmail.com->More (down-arrow to top right)->Report Phishing 

Report Phishing to Google

If you have received this email, take further action by

1. https://www.google.com/safebrowsing/report_phish/

Report phishing at Microsoft and government agencies

1. http://www.microsoft.com/security/online-privacy/phishing-faq.aspx

Report phishing for Web hosting companies (e.g., GoDaddy, Cloudflare, Digital Ocean) and ISPs

1. SpamCop.net - Sign up for SpamCop reporting

Anti‑Phishing Working Group (APWG) — forward to reportphishing@apwg.org

-------------------------------------------------------------------------------------------------------------

💣 📧 Check if your username or email has been hacked